AI Research Portal

This paper introduces SafeR-CLIP, a fine-tuning framework designed to mitigate Not Safe For Work (NSFW) content in Vision-Language Models (VLMs) while preserving their pre-trained knowledge and generalization capabilities. The core idea is proximity-aware realignment, which redirects unsafe concepts to their semantically closest safe alternatives, minimizing representational change. SafeR-CLIP employs novel representation-aware losses, including relative cross-modal redirection and proximity-based alignment, along with a progressive training strategy. The method achieves state-of-the-art results, recovering up to 8.0% in zero-shot accuracy over prior safety fine-tuning approaches while maintaining robust safety.

The paper identifies several bottlenecks with existing methods for mitigating NSFW content in VLMs:

Performance-Safety Trade-off: Fine-tuning VLMs for safety often leads to significant drops in generalization performance, with prominent methods incurring a substantial 22% drop in zero-shot accuracy on standard benchmarks.

Identification of an overlooked challenge: The paper identifies that prior work's assumption of a single safe counterpart per unsafe concept leads to representational shift and reduced generalization, and shows that aligning to semantically closest safe alternatives mitigates these issues.
Representation-aware training losses: Two novel losses are proposed: relative cross-modal redirection, which corrects negative selection, and proximity-based alignment, which aligns unsafe inputs to semantically compatible safe targets, jointly improving safety with minimal disruption to pre-trained representations.
New benchmark for robust safety evaluation: NSFWCaps is introduced, a cross-modal safety benchmark with 1,000 highly-aligned safe-unsafe pairs, providing a more rigorous test of safety generalization under distributional shift.
State-of-the-art performance: SafeR-CLIP achieves new state-of-the-art results on safety and retrieval benchmarks, improving zero-shot performance by 8% over prior safety fine-tuning approaches while maintaining comparable safety.

SafeR-CLIP is a fine-tuning framework that employs a principle of minimal intervention, redirecting unsafe concepts to their semantically closest safe alternatives.

Key Idea: Proximity-aware realignment. Instead of rigid mapping, the approach identifies the semantically closest safe alternative for any unsafe input and gently redirects the representation towards this target, respecting the model's pre-trained knowledge.

Losses: The framework uses two novel, representation-aware losses:

Relative Cross-Modal Redirection: This loss refines contrastive learning by specifying the unsafe representation (from the frozen reference model) as the sole negative, preserving rich semantic associations between related safe concepts.
- Image Encoder Loss: Limage_cross-redir = (1/N) Σ_{i=1}^N log (1 + exp (cos(V(v_i^u), T_0(t_i^u)) - cos(V(v_i^u), T_0(t_i^s)))) where N is batch size, V is the image encoder, T_0 is the frozen reference text encoder, v_i^u is the unsafe image, and t_i^s and t_i^u are the corresponding safe and unsafe captions, respectively.
Proximity-Based Alignment: This loss dynamically identifies the most semantically compatible safe target for each unsafe input, mitigating issues from noisy training pairs.
- Selecting Semantically Aligned Safe Pairs: For a given unsafe caption t^u, its cosine similarity S_{ij} = cos(T_0(t^u), T_0(t_j^s)) is computed with every candidate safe caption t_j^s. The best-matching safe caption t_j*^s = arg max_j S_{ij} and its corresponding image v_j*^s form the aligned safe pair (v_j*^s, t_j*^s) for training. This retrieval is performed offline.
- Updated Relative Cross-Modal Redirection: The fixed safe counterpart t_i^s in the original relative cross-modal redirection loss is replaced with the closest semantically aligned safe embedding t_i*^s. Limage_prox-cross-redir = (1/N) Σ_{i=1}^N log (1 + exp (cos(V(v_i^u), T_0(t_i^u)) - cos(V(v_i^u), T_0(t_i*^s))))
- Updated Uni-Modal Redirection: The uni-modal redirection loss is also updated by replacing the fixed safe target with the closest semantically aligned counterpart v_i*^s. Limage_prox-uni-redir = (1/N) Σ_{i=1}^N cos(V(v_i^u), V_0(v_i*^s)) where V is the trainable image encoder and V_0 is its frozen reference counterpart.
Full Redirection Loss: The complete redirection loss combines both cross-modal and uni-modal objectives, each based on proximity-aware alignment: L_redir = Limage_prox-cross-redir + Ltext_prox-cross-redir + Limage_prox-uni-redir + Ltext_prox-uni-redir. Preservation losses, similar to Safe-CLIP, are also included to maintain the global structure of CLIP's pre-trained embedding space.

Progressive Training: A progressive training schedule is adopted based on the difficulty of unsafe samples (easy, medium, hard, categorized by cosine similarity between captions). Training proceeds in three phases: (1) easy unsafe-safe pairs for stable initialization, (2) medium samples to improve redirection strength, and (3) hard examples requiring larger representational shifts.

Architecture: Built on CLIP architecture, using ViT-L/14 variant as the main backbone.
Fine-tuning: Both vision and text encoders are fine-tuned using LoRA adapters with a fixed rank of r = 16.
Optimizer: Adam optimizer.
Learning Rate: 1×10-4.
Batch Size: 48.
Epochs: 9 epochs.
Progressive Training Schedule:
- Epoch 1: Only easy unsafe-safe pairs.
- Epoch 2: Easy and medium samples.
- Remaining epochs: All three difficulty levels (easy, medium, hard).
Random Seed: A fixed random seed of 42 is used for all training and evaluation runs.
Synthetic Data Generation Seed: The generation seed for ViSU training data is fixed to 8185.
Hardware: All experiments are conducted on A6000 GPUs.
Base Framework: Safe-CLIP (Poppi et al. 2024a) public repository.
NSFWCaps Benchmark Creation:
- Starts with image-caption pairs from the validation split of NoCaps (Agrawal et al. 2019b).
- Related unsafe variants generated using LLaMA-3-70B (Grattafiori et al. 2024) by editing safety-relevant details while preserving original semantics across 20 NSFW categories.
- Unsafe images generated using an NSFW-tuned Stable Diffusion model, yielding 4.5K image-text pairs.
- Multi-stage filtering pipeline: NudeNet (Bedapudi 2019) and Q16 detector (Schramowski et al. 2023a) for visual unsafety.
- JINA-CLIP (Koukounas et al. 2024) similarity computed between safe-unsafe caption pairs to retain most semantically aligned examples.
- Final dataset: 1,000 quadruplets with safe image, unsafe image, safe caption, and unsafe caption.
- Average JINA-CLIP similarity for safe and unsafe captions: 0.81 (NSFWCaps) vs. 0.62 (ViSU).

Datasets:
- Training: ViSU (Poppi et al. 2024a) (169K quadruplets).
- Generalization Evaluation: 11 benchmarks including ImageNet and its variants (IN-A, IN-R, IN-V2, IN-S), Caltech101, Oxford Pets, Flowers102, Stanford Cars, UCF101, and DTD.
- NSFW Evaluation: ViSU test set (5K samples), NSFWCaps benchmark (1K curated pairs), NudeNet (Bedapudi 2019), SMID (Crone et al. 2018), public NSFW URLs, I2P benchmark (Schramowski et al. 2023a).
Metrics:
- Retrieval performance (R@1) for Safe-to-Safe (T → V, V → T) and Unsafe-to-Safe Redirection (T* → V, V* → T).
- Average zero-shot classification accuracy across 11 datasets.
- Average NSFW score for text-to-image generation (↓ is better).
- NSFW % and Toxicity scores for image-to-text generation (↓ is better).
Baselines: CLIP (Radford et al. 2021), DataComp-1B (Gadre et al. 2023), CLIP† (fine-tuned on safe data only), Safe-CLIP (Poppi et al. 2024a).
Numeric Results:
- Cross-Modal Retrieval (Table 1):
  - ViSU:
    - Safe-to-Safe (T → V): Ours 52.0 (+2.9%) vs. Safe-CLIP 49.1.
    - Safe-to-Safe (V → T): Ours 51.5 (+2.7%) vs. Safe-CLIP 48.8.
    - Unsafe-to-Safe (T* → V): Ours 27.9 (+13.4%) vs. Safe-CLIP 14.5.
    - Unsafe-to-Safe (V* → T): Ours 24.6 (+0.8%) vs. Safe-CLIP 23.8.
  - NSFWCaps:
    - Safe-to-Safe (T → V): Ours 81.8 (+5.2%) vs. Safe-CLIP 76.6.
    - Safe-to-Safe (V → T): Ours 78.1 (+1.4%) vs. Safe-CLIP 76.7.
    - Unsafe-to-Safe (T* → V): Ours 79.5 (+44.1%) vs. Safe-CLIP 35.4.
    - Unsafe-to-Safe (V* → T): Ours 72.3 (+25.2%) vs. Safe-CLIP 47.1.
- Zero-Shot Classification Generalization (Table 1):
  - Average accuracy: Ours 60.2 (+8.0%) vs. Safe-CLIP 52.2.
- Robustness to Real NSFW Images (Table 2):
  - % NSFW V → T (NSFW URLs): Ours 18.5 vs. Safe-CLIP 21.1.
  - % NSFW V → T (NudeNet): Ours 10.7 vs. Safe-CLIP 13.0.
  - % NSFW V → T (SMID): Ours 3.1 vs. Safe-CLIP 14.2.
  - % NSFW T → V (NSFW URLs): Ours 37.2 vs. Safe-CLIP 41.1.
  - % NSFW T → V (NudeNet): Ours 27.0 vs. Safe-CLIP 43.1.
  - % NSFW T → V (SMID): Ours 16.9 vs. Safe-CLIP 26.6.
- Text-to-Image Generation (Table 3):
  - Average NSFW score on I2P benchmark: Ours 16.0 (+0.1%) vs. +Safe-CLIP 16.1.
- Image-to-Text Generation (Table 4):
  - NudeNet NSFW %: Ours 25.4 vs. +Safe-CLIP 31.5.
  - NudeNet Tox.: Ours 12.4 vs. +Safe-CLIP 16.4.
  - NSFW URLs NSFW %: Ours 27.6 vs. +Safe-CLIP 27.9.
  - NSFW URLs Tox.: Ours 11.0 vs. +Safe-CLIP 13.6.
  - SMID NSFW %: Ours 7.7 vs. +Safe-CLIP 8.8.
  - SMID Tox.: Ours 3.6 vs. +Safe-CLIP 4.1.
Runtime/Training Cost: Not stated in the paper.

Weakens generalization and cross-modal alignment: The cross-modal redirection loss in prior methods (e.g., Safe-CLIP) causes the model to disregard valid alternative safe concepts and actively pushes them apart, disrupting CLIP's cross-modal embedding structure and leading to a significant drop in zero-shot performance (approximately 22%).
Semantically misaligned fixed targets: Prior methods enforce a rigid, noisy mapping between unsafe and safe concepts, relying on manually defined pairs without ensuring semantic compatibility, which can distort the pre-trained embedding space.

Method evidence: "To this end, we propose SafeR-CLIP, a framework that employs two novel, representation-aware losses. The first, relative cross-modal redirection, refines contrastive learn-ing by specifying the unsafe representation as the sole neg-ative, which preserves the rich semantic associations be-tween all related safe concepts. The second, proximity-based alignment, mitigates issues from noisy training pairs by dynamically identifying the most semantically compat-ible safe target for each unsafe input." (section: Abstract)
Result evidence: "SafeR-CLIP sets new state-of-the-art results on safety and retrieval bench-marks, improving zero-shot performance by 8% over prior safety fine-tuning approaches while maintaining comparable safety." (section: Abstract)
Limitation evidence: "Safe-CLIP enforces a rigid noisy mapping between unsafe and safe concepts, relying on manually defined pairs without en-suring semantic compatibility. This can lead to misaligned supervision that distorts the pretrained embedding space." (section: Limitations of Safe-CLIP)

SafeR-CLIP: Mitigating NSFW Content in Vision-Language Models While Preserving Pre-Trained Knowledge

Summary

Problem

Key Contributions

Method

Technical Details

Results

Weaknesses / Limitations

Evidence

Additional Figures